[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements:

| Date | Type | Change | Page Number | |-----------|-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------| | 1/20/2016 | Editorial | Changed the revision from '3' to '4' | cover page, i, ii | | | Editorial | Added new author: 'Dragos Prisaca' | cover page, i | | | Editorial | Changed secretary name to 'Penny Pritzker, Secretary' | i | | | Editorial | Changed the date of the document | i | | | Substantive | Changed abstract from 'This report defines the requirements and associated test procedures necessary for products to achieve one or more Security Content Automation Protocol (SCAP) validations.' to 'This report defines the requirements and associated test procedures necessary for products or modules to achieve one or more Security Content Automation Protocol (SCAP) validations.' | iii | | | Editorial | Added keywords 'SCAP validated products; SCAP validated modules' | iii | | | Editorial | Updated the Acknowledgements section | iv | | | Substantive | Changed 'SCAP Product' to 'SCAP product and module' in the Audience section | iv | | | Substantive | Changed the Trademark Information section from 'Windows XP, Windows Vista, and Windows 7 are registered trademarks of Microsoft Corporation.' to 'Windows® operating

Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Recommendation for Block Cipher Modes of Operation_ Three Variants of Ciphertext Stealing for CBC Mode provide?

[Assistant]
Addendum to NIST Special Publication 800-38A October, 2010

<!-- image -->

Recommendation for Block Cipher Modes of Operation: Three Variants of Ciphertext Stealing for CBC Mode

Morris Dworkin

## C O M P U T E R S E C U R I T Y

Addendum to NIST Special Publication 800-38A

## Recommendation for Block Cipher Modes of Operation: Three Variants of Ciphertext Stealing for CBC Mode

Morris Dworkin

## C O M P U T E R S E C U R I T Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

October 2010

<!-- image -->

U.S. Department of Commerce

Gary Locke, Secretary

National Institute of Standards and Technology Patrick Gallagher, Director

## Reports on Information Security Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and  Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement  and  standards  infrastructure. ITL  develops  tests,  test  methods,  reference  data,  proof  of concept  implementations,  and  technical  analyses  to  advance  the  development  and  productive  use  of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive  unclassified  information  in  Federal  computer  systems. This  Special  Publication  800-series reports  on  ITL's  research,  guidance,  and  outreach  efforts  in  computer  security,  and  its  collaborative activities with industry, government, and academic organizations. Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.

Recommendation for Block Cipher Modes of Operation_ Three Variants of Ciphertext Stealing for CBC Mode

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Implementation of DevSecOps for a Microservices-based Application with Service Mesh:

are supported by an infrastructure for providing application services, such as service mesh. Both of these components are usually hosted on a container orchestration and resource management platform.
In this architecture, the entire set of source code involved in the application environment can be divided into five code types: 1) application code (which embodies the application logic), 2) application services code (for services such as session establishment, network connection, etc.), 3) infrastructure as code (for provisioning and configuring computing, networking, and storage resources), 4) policy as code (for defining runtime policies such as zero trust expressed as a declarative code), 5) and observability as code (for the continuous monitoring of an application runtime state). Due to security, business competitiveness, and the inherent structure of loosely coupled application components, this class of applications needs a different development, deployment, and runtime paradigm. DevSecOps (consisting of acronyms for Development, Security, and Operations, respectively) has been found to be a facilitating paradigm for these applications with primitives such as continuous integration, continuous delivery, and continuous deployment (CI/CD) pipelines. These pipelines are workflows for taking the developer's source code through various stages, such as building, testing, packaging, deployment, and operations supported by automated tools with feedback mechanisms. The objective of this document is to provide guidance for the implementation of DevSecOps primitives for cloud-native applications with the architecture and code types described above. The benefits of this approach for high security assurance and for enabling continuous authority to operate (C-ATO) are also discussed.

Implementation of DevSecOps for a Microservices-based Application with Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness:

.g., encryption) which require limited human interaction, particularly with users, education and awareness addresses the human-in-the-loop and so depends, in large part, on human-factors for efficacy.
All three teams specifically considered how their designs could be 'easiest' for users to use, understand, and be most accessible. Teams 1 and 3 incorporated gamification and other interactive elements to encourage users to pursue cybersecurity topics. For example, Team 3 attempted to gamify the pursuit of cybersecurity knowledge relative to the product by building out 'levels' of concepts that build upon each other so that users could 'level up' at their pace. Understanding and encouraging cybersecurity engagement has been a focus of research for the SOUPS community [8][9][10][11][12][13], and so the teams brought the insights from that research to the practical tasks of the Design-A-Thon. The contextual nature of cybersecurity education and awareness approaches was apparent when two teams (i.e., Teams 2 and 3) selected the same product but developed different approaches and focused on different aspects of the design. Teams 2 and 3 homed in on different information that may be useful at different times during the product's lifecycle. In one case, Team 2 focused on ensuring information was at users' fingertips, particularly when support was needed. In the other case, Team 3 considered how individuals could be encouraged to engage on cybersecurity education and awareness outside of times they needed support, landing on gamification elements. Research shows that gamification of cybersecurity education and awareness can drive engagement for individuals around the subject [14], but for IoT products, gamification elements should not get in the way when users need support or specific information.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Annual Report 2018_ NIST_ITL Cybersecurity Program:

- The Nation should set an ambitious vision and action plan-of-attack to 'prepare, grow, and sustain a national cybersecurity workforce that safeguards and promotes America's national security and economic prosperity.'
- The Federal Government should lead in launching a high-profile national Call to Action to draw attention to and mobilize public and private sector resources to address cybersecurity workforce needs. - The Administration should focus on and recommend long-term authorization and sufficient appropriations for high-quality, effective cybersecurity education and workforce development programs in its budget proposals in order to grow and sustain the cybersecurity workforce. - Federal departments and agencies must move quickly to address major needs relating to recruiting, developing, and retaining cybersecurity employees and continue to implement the Federal Cybersecurity Workforce Strategy 43  and the Federal Cybersecurity Workforce Assessment Act of 2015 (FCWAA). 44
- The private and public sectors need to transform, elevate, and sustain the learning environment to grow a dynamic and diverse cybersecurity workforce. - The private and public sectors need to align education and training with employers' cybersecurity workforce needs, improve coordination, and prepare individuals for lifelong careers. - The private and public sectors need to establish and leverage measures that demonstrate the effectiveness and impact of cybersecurity workforce investments.

Annual Report 2018_ NIST_ITL Cybersecurity Program


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Hardware Security Failure Scenarios_ Potential Hardware Weaknesses provide? (Part 5)

[Assistant]
..........9                         |
| 3. Technical Approach......................................................................................................................10         |
| 3.1.1.
Determining How Weaknesses Occur........................................................................................10                     |
| 3.1.2. Determining Where Weaknesses Occur.....................................................................................10                      |
| 3.1.3. Determining What Damage Weaknesses Allow.........................................................................10                            |
| 4. Hardware Security Failure Scenarios.............................................................................................14                 |
| 5. Categories of Hardware Design Weaknesses .................................................................................33                       |

| 6. Comparison With Software Weaknesses.......................................................................................46                     |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 7. Software Assurance Trends Categories..........................................................................................50                 |
| 8. Conclusion ...................................................................................................................................53 |
| References.......................................................................................................................................54 |
| Appendix A. List of Symbols, Abbreviations, and Acronyms...............................................................65                           |
| Appendix B.

Hardware Security Failure Scenarios_ Potential Hardware Weaknesses

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Managing Information Security Risk_ Organization, Mission, and Information System View:

Supplemental Guidance: Organizations can respond to risk in a variety of ways. These include: (i) risk acceptance; (ii) risk avoidance; (iii) risk mitigation; (iv) risk sharing; (v) risk transfer; or (vi) a combination of the above. A course of action is a time-phased or situation-dependent combination of risk response measures. For example, in an emergency situation, organizations might accept the risk associated with unfiltered connection to an external communications provider for a limited time; then avoid risk by cutting the connection; mitigate risk in the near-term by applying security controls to search for malware or evidence of unauthorized access to information that occurred during the period of unfiltered connection; and finally mitigate risk long-term by applying controls to handle such connections more securely. Supplemental Guidance: The evaluation of alternative courses of action can include: (i) the expected effectiveness in achieving desired risk response (and how effectiveness is measured and monitored); and (ii) anticipated feasibility of implementation, including, for example, mission/business impact, political, legal, social, financial, technical, and economic considerations. Economic considerations include costs throughout the expected period of time during which the course of action is followed (e.g., cost of procurement, integration into organizational processes at Tier 1 and/or Tier 2, information systems at Tier 3, training, and maintenance). During the evaluation of alternative courses of action, trade-offs can be made explicit between near-term gains in mission/business effectiveness or efficiency and long-term risk of mission/business harm due to compromise of information or information systems that are providing this nearterm benefit.

Managing Information Security Risk_ Organization, Mission, and Information System View


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Recommendation for Random Bit Generator (RBG) Constructions:

-------------------------------------------------------------------------|
| [SP_800-38B]      | Dworkin MJ (2005) Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication.
(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-38B, Includes updates as of October 6, 2016. https://doi.org/10.6028/NIST.SP.800-38B                      |
| [SP_800-90A]      | Barker EB, Kelsey JM (2015) Recommendation for Random Number Generation Using Deterministic Random Bit Generators. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-90Ar1. https://doi.org/10.6028/NIST.SP.800-                                                    |
| [SP_800-90B]      | 90Ar1 Sönmez Turan M, Barker EB, Kelsey JM, McKay KA, Baish ML, Boyle M (2018) Recommendation for the Entropy Sources Used for Random Bit Generation. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-90B. |
| [SP_800_224]      | Sönmez Turan M, Brandão LTAN (20 24) Keyed-Hash Message Authentication Code (HMAC): Specification of HMAC and Recommendations for Message Authentication. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-224 ipd . https://doi.org/10.6028/ NIST.SP.800-22 4.ipd |
| [SP800_90WebSite] | National Institute of Standards and Technology (2025) Random Bit Generation [SP 800-90 Project]. Available at https://csrc.nist.gov/Projects/random-bit-generation/sp-800 -90-updates                                                                                |

Recommendation for Random Bit Generator (RBG) Constructions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Digital Identity Guidelines:

3.6.

3.6. Redress
Designing services that support a wide range of populations requires processes to
adjudicate issues and provide redress4
 as warranted. Service failures, disputes, and
other issues tend to arise as part of normal operations, and their impacts can vary
broadly, from minor inconveniences to major disruptions or damage. Furthermore,
the same issue experienced by one person or community as an inconvenience can have
disproportionately damaging impacts on other individuals and communities.

authentication intent
The process of confirming the claimant’s intent to authenticate or reauthenticate by
requiring user intervention in the authentication flow. Some authenticators (e.g., OTPs)
establish authentication intent as part of their operation. Others require a specific step
to establish intent, such as pressing a button. Authentication intent is a countermeasure
against malware at the endpoint as a proxy for authenticating an attacker without the
subscriber’s knowledge.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Engineering Trustworthy Secure Systems provide? (Part 2)

[Assistant]
aft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.
## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## NIST Technical Series Policies

Copyright, Fair Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2022-11-08 Supersedes NIST SP 800-160 Vol. 1 (Nov. 2016; updated 2018-03-21) https://doi.org/10.6028/NIST.SP.800-160v1

## How to Cite this NIST Technical Series Publication:

Ross R, McEvilley M, Winstead M (2022) Engineering Trustworthy Secure Systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Security Analysis of First Responder Mobile and Wearable Devices provide?

[Assistant]
## NISTIR 8196

## Security Analysis of First Responder Mobile and Wearable Devices

Joshua M. Franklin Gema Howell Scott Ledgerwood Jaydee L. Griffith

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8196

<!-- image -->

## NISTIR 8196

## Security Analysis of First Responder Mobile and Wearable Devices

Joshua M. Franklin* Gema Howell Applied Cybersecurity Division Information Technology Laboratory

Scott Ledgerwood Public Safety Communications Research Division Communications Technology Laboratory

Jaydee L. Griffith Institute for Telecommunication Sciences National Telecommunications and Information Administration

* Former employee; all work for this

Publication was done while at NIST

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8196

May 2020

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8196 75 pages (May 2020)

## This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8196

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.

Security Analysis of First Responder Mobile and Wearable Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products:

Product criteria are recommended to apply to the IoT product overall, as well as to each individual IoT product component (e.g., IoT device, backend, companion app), as appropriate. 6 A scheme owner has flexibility in adapting the product criteria and determining appropriate supporting evidence. Though NIST recommends that all criteria apply to every IoT product, some components may not be able or need to support all criteria. That might be the case due to product risk considerations, product development (e.g., cybersecurity tasks delegated via contracts and supply chain), nature of the components to form the product (e.g., backends may be highly distributed), or limitations of IoT components (e.g., devices may be constrained, companion software apps may have limited access and functionality). - iv. Consideration of the known risks related to the IoT product and known potential misuses. - v. Secure software development and supply chain practices used. - vi. Accreditation, certification, and/or evaluation results for cybersecurityrelated practices. - vii. The ease of installation and maintenance of the IoT product by a customer (i.e., the usability of the product [ISO9241]). - e. Maintenance requirements for the IoT product, for example :
- i. Cybersecurity maintenance expectations and associated instructions or procedures (e.g., vulnerability/patch management plan). - ii. How the IoT product developer identifies authorized supporting parties who can perform maintenance activities (e.g., authorized repair centers). - iii. Cybersecurity considerations of the maintenance process (e.g., how customer data unrelated to the maintenance process remains confidential even from maintainers). - f. The secure system lifecycle policies and processes associated with the IoT product, including :
- i. Steps taken during development to ensure the IoT product and its product components are free of any known, exploitable vulnerabilities. - ii.

Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Physical Protection?

[Assistant]
According to Fiscal Year 2023 Cybersecurity and Privacy Annual Report:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Fiscal Year 2023 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Security Architecture Design Process for Health Information Exchanges (HIEs):

| Capstone Policy Drivers | Entities Affected | Enabling Services Affected | Comment | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | American Recovery and Reinvestment Act of 2009, Public Law 111-5 (ARRA) | HIPAA-covered entities and their business associates; PHR vendors; and possibly other health-related organizations | Risk Assessment; Secured Communication Channel; Document Confidentiality | Requires the Office of the National Coordinator to establish two panels on health IT; holds business associates of HIPAA-covered entities directly responsible for certain standards of the Privacy and Security Rules; requires certain HIPAA covered entities to notify individuals who have been affected by breaches of their health information.

Security Architecture Design Process for Health Information Exchanges (HIEs)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Media Protection?

[Assistant]
According to Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”:

- Risks posed by unsupported "zombie devices" that lack updates or patches, compensating controls to address the additional risk from this status, and continue to operate on the network, creating security blind spots;
- Lack of secure disposal for decommissioned IoT products and product components to prevent exploitation of sensitive data or credentials as a weakness in the IoT ecosystem;
- Absence of modular replacement strategies for IoT products in long-term use cases such as industrial or healthcare settings where lifespans for products may be long;
- Concerns raised regarding replay attacks during ownership transitions that can make the prior owner's data accessible to the new owner;
- Potential for unexpected or nefarious activity from IoT products such as collecting unintended data continues to impede trust in IoT;
- Practical complexities of integrating IoT products into diverse ecosystems; and
- Technical challenges to supporting post-quantum cryptography for most IoT products, particularly on IoT devices.

Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Workshop Summary Report for “Building on the NIST Foundations_ Next Steps in IoT Cybersecurity”:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

Workshop Summary Report for “Building on the NIST Foundations_ Next Steps in IoT Cybersecurity”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Conformance Assessment of Transport Layer Security Implementations provide?

[Assistant]
<!-- image -->

E

p

p

## Conformance Assessment of Transport Layer Security Implementations

-Qe100 .056

## Wayne A. Jansen Editor

U.S. DEPARTMENT OF COMMERCE Technology Administration National Institute of Standards and Technology Computer Systems Laboratory Gaithersburg, MD 20899

<!-- image -->

## Conformance Assessment of Transport Layer Security Implementations

## Wayne A. Jansen Editor

U.S. DEPARTMENT OF COMMERCE Technology Administration National Institute of Standards and Technology Computer Systems Laboratory Gaithersburg, MD 20899

[December 1993

<!-- image -->

U.S. DEPARTMENT OF COMMERCE Ronald H. Brown, Secretary

TECHNOLOGY ADMINISTRATION Mary L Good, Linder Secretary for Technology

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY Arati Prabhakar, Director

## ABSTRACT

This paper presents a framework for evaluating conformance of a protocol implementation to the Security Protocol at layer 4 (SP4) standard. SP4 is one element of the Secure Data Network System (SDNS) architecture, used to provide security services at the Transport layer of the Open System Interconnection (OSI) reference model. SP4 also forms the basis of the ISO standard for the OSI Transport Layer Security Protocol (TLSP). Therefore, with few exceptions, the findings of the paper are applicable to TLSP. The paper explores the relationship between conformance assessment, interoperability assessment, and security evaluation of security protocols. The OSI conformance testing methodology and framework is reviewed, and a strategy is given for applying this methodology to SP4 implementations. Keywords: OSI, Lower Layer Security Protocols, Conformance Testing, Security Evaluation, Interoperability Testing, SP4. ## TABLE OF CONTENTS

| 1. | INTRODUCTION                                  | INTRODUCTION                                  |   1 |
|------------|-----------------------------------------------|-----------------------------------------------|-----|
| 2.

Conformance Assessment of Transport Layer Security Implementations

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Internet of Things (IoT) Cybersecurity Colloquium_ A NIST Workshop Proceedings provide? (Part 5)

[Assistant]
| Defining the Internet of Things........................................................................
3                    |
|                    | 2.2                                                                                | IoT Cybersecurity and Privacy Risks .............................................................. 3                         |
|                    | 2.3                                                                                | IoT-Specific Risks ...........................................................................................

Internet of Things (IoT) Cybersecurity Colloquium_ A NIST Workshop Proceedings


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS):

SC-13   | For the protection of keys and metadata used to protect data at the Moderate impact-level, a Federal CKMS shall employ cryptographic modules validated at FIPS 140 security level 3 or higher.
|
| PR:2.13  | SC-13   | For the protection of keys and metadata used to protect data at the High impact-level, a Federal CKMS shall employ cryptographic modules validated at FIPS 140 physical security level 4, and all other areas at security levels 3 or higher. |
| PA:2.2   |         | A Federal CKMS should assure that all its cryptographic modules are protected against invasive and non-invasive attacks. |

A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i:

3.2.5 Availability... 3.2.5 discuss pre-RSN IEEE 802. 3.2.5 Availability

Individuals who do not have physical access to the WLAN infrastructure can cause a denial of service for the WLAN.

Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

.................................................................... 41    | APPENDIX C: REFERENCES.....................................................................................................
41    |

The information system owner 6 is the agency official responsible for the overall procurement, development, integration, modification, or operation and maintenance of the information system. The information system owner has the following responsibilities related to system security plans:

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Recommendation for Cryptographic Key Generation provide?

[Assistant]
## NIST Special Publication 800-133 Revision 2

## Recommendation for Cryptographic Key Generation

Elaine Barker Allen Roginsky Richard Davis

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-133r2

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

<!-- image -->

## NIST Special Publication 800-133 Revision 2

## Recommendation for Cryptographic Key Generation

Elaine Barker Allen Roginsky Computer Security Division Information Technology Laboratory

Richard Davis National Security Agency

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-133r2

June 2020

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

## Authority

This  publication  has  been  developed  by  NIST  in  accordance  with  its  statutory  responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq. ,  Public  Law  (P.L.)  113-283. NIST  is  responsible  for  developing  information  security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval  of  appropriate  federal  officials  exercising  policy  authority  over  such  systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing  in  this  publication  should  be  taken  to  contradict  the  standards  and  guidelines  made mandatory  and  binding  on  federal  agencies  by  the  Secretary  of  Commerce  under  statutory authority. Nor  should  these  guidelines  be  interpreted  as  altering  or  superseding  the  existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official.

Recommendation for Cryptographic Key Generation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to U.S. Department of Energy Risk Assessment Methodology:

|
|                                    | 2. | Risk Assessment: Computer Based Tools                       |                                    |
|                                    | 3.
| Threats and Vulnerabilities                                 |                                    |
|                                    | 4. | Countermeasures: Equipment and Technologies                 |                                    |
|                                    | 5. | Countermeasures: Procedures                                 |                                    |
|                                    | 6. | Networks                                                    |                                    |
|                                    | 7. | Viruses and Other Related Threats                           |                                    |
|                                    | 8. | Risk Management                                             |                                    |
|                                    | 9. | Certification and Accreditation                             |                                    |
|                                    | 10. | Other U.S. Government Computer Security Publications        |                                    |

U.S. Department of Energy Risk Assessment Methodology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Using Vulnerability Naming Schemes provide? (Part 4)

[Assistant]
............................... 2 2.1 Common Vulnerabilities and Exposures (CVE) 2.2 Common Configuration Enumeration (CCE) 5...........................................................3 |
| 1.1 1.2 2.
| Authority....................................................................................................................1 Purpose and Scope...................................................................................................1                  |
| 1.3               | Audience ...................................................................................................................1                                                                                |
| 1.4               | Document Structure ..................................................................................................1                                                                                |
|                   | .........................................................2                                                                                |
| 3. | 4                                                                                |
|                   | Recommendations for End-User Organizations ............................................................

Guide to Using Vulnerability Naming Schemes


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Cybersecurity Framework Version 1.1 Manufacturing Profile:

NISTIR 8183 Revision 1 updates the Manufacturing Profile to include the sub-category enhancements established in NIST Framework for Improving Critical Infrastructure Cybersecurity Version 1.1. These updates include managing cybersecurity within the supply chain, self-assessing cybersecurity risk, vulnerability disclosure, system integrity, and more comprehensive controls for identity management.

Cybersecurity Framework Version 1.1 Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.3 (NIST 3.1.3)?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 1_ Overview:

3.1.3 Simplifies Understanding of the Overall Protection Process... 3.1.3 Simplifies Understanding of the Overall Protection Process

It is a difficult task to achieve detailed understanding of hundreds of individual security control items, thus, defining security capabilities may simplify how the protection problem is viewed conceptually.

Automation Support for Security Control Assessments_ Volume 1_ Overview


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Application Container Security Guide provide?

[Assistant]
## NIST Special Publication 800-190

## アプリケーションコンテナセキュリティガイド

Murugiah Souppaya John Morello Karen Scarfone

本書は、以下より無料で利用可能である： https://doi.org/10.6028/NIST.SP.800-190

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

この文書は以下の団体によって翻訳監修されています

<!-- image -->

本文書は、原典に沿ってできるだけ忠実に翻訳するよう努めていますが、完全性、 正確性を保証するものではありません。

翻訳監修主体は、本文書に記載されている情報より生じる損失または損害に対し て、いかなる人物あるいは団体についても責任を負うものではありません。

<!-- image -->

## NIST Special Publication 800-190 アプリケーションコンテナセキュリティガイド

Murugiah Souppaya Computer Security Division Information Technology Laboratory

John Morello Twistlock Baton Rouge, Louisiana

Karen Scarfone Scarfone Cybersecurity Clifton, Virginia

本書は、以下より無料で利用可能である： https://doi.org/10.6028/NIST.SP.800-190

2017 年 9 月

<!-- image -->

米国商務省 Wilbur L. Ross, Jr., Secretary

米国国立標準技術研究所

Kent Rochford, Acting Under Secretary of Commerce for Standards and Technology and Acting Director

## 発行機関

本文書は、連邦情報セキュリティ近代化法（ FISMA ： Federal Information Security Modernization Act ） 2014 年、合 衆国法典（ U.S. Code ）第 44 編 第 3541 条 等、および公法（ P.L. ） 113 条 -283 条に基づく法的責任により、米国国 立標準技術研究所（ NIST ： National Institute of Standards and Technology 、以下、 NIST と称す）によって作成され た。 NIST は、連邦政府情報システムの最低限の要求事項を含む情報セキュリティ標準及びガイドラインを策定する 責務があるが、このような標準及びガイドラインを国家安全保障システムに適用するには、このようなシステムに ついての政策的権限を有する適切な連邦政府機関の明確な承認が必要となる。このガイドラインは、行政管理予算 庁（ OMB ： Office of Management and Budget ）による通達（ Circular ） A-130 号の要求事項と一致している。

本文書のいかなる内容も、商務長官が法的権限に基づき連邦政府に対して義務及び拘束力を与えた標準及びガイド ラインを否定するものではない、また、これらのガイドラインは、商務長官、行政管理予算局長、または他のすべ ての連邦政府当局者の既存の権威に変更を加えたり、これらに取って代わるものと解釈したりしてはならない。本 文書は、非政府組織が自由に使用することもでき、米国における著作権の対象ではないが、 NIST に帰属する。

National Institute of Standards and Technology Special Publication 800-190 Natl. Inst. Stand. Technol. Spec. Publ.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Digital Identity Guidelines_ Federation and Assertions:

| 1. Introduction . . . . . . . . . . . . . | 1. Introduction . . . . . . . . . . . . . | 1. Introduction . . . . . . . . . . . . . |
|---------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------|
|                                                                                | 1.1. . . . . . . . . . . . . . . . | Notations . . . . . . . . . . . . . . . . . . . 1                                     |
|                                                                                | 1.1.1. Cryptographic Terminology . | . . . . . . . . . . . . . . . . . . . 2                                               |
| 1.2. | Document Structure . . . . . . . . . | . . . . . . . . . . . . . . . . . . . 3                                               |
| 2. Federation Assurance Level (FAL) . . . . . . . . . . . . . . . . . . . . . . . . 4 | 2. Federation Assurance Level (FAL) . . . . . . . . . . . . . . . . . . . . . . . . 4 | 2. Federation Assurance Level (FAL) . . . . . . . . . . . . . . . . . . . . . . . . 4 |
|                                                                                | 2.1. . . . . | Common FAL Requirements . . . . . . . . . . . . . . . . . . . . 5                     |
|                                                                                | 2.2. | Federation Assurance Level 1 (FAL1) . . . . . . . . . . . . . . . . . . . . 6         |
|                                                                                | 2.3. | Federation Assurance Level 2 (FAL2) . . . . . . . . . . . . . . . . . . . . 6         |
|                                                                                | 2.4. | Federation Assurance Level 3 (FAL3) . . . . . . . . . . . . . . . . . . . . 7         |
| 2.5.

Digital Identity Guidelines_ Federation and Assertions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N provide?

[Assistant]
## NIST Special Publication 800-178

## A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications

Extensible Access Control Markup Language (XACML) and Next Generation Access Control (NGAC)

David Ferraiolo Ramaswamy Chandramouli Vincent Hu Rick Kuhn

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-178

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

<!-- image -->

## NIST Special Publication 800-178

## A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications

Extensible Access Control Markup Language (XACML) and Next Generation Access Control (NGAC)

David Ferraiolo Ramaswamy Chandramouli Vincent Hu Rick Kuhn Computer Security Division Information Technology Laboratory

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-178

Octo ber 2016

<!-- image -->

U.S. Department of Commerce Penny Pritzker, Secretary

National Institute of Standards and Technology Willie May, Under Secretary of Commerce for Standards and Technology and Director

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.

A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide to LTE Security:

| Document Structure........................................................................................
| 6                                                                                |
|                                                                                | 1.3                                                                                | Document Conventions................................................................................... | 7                                                                                |
| 2                                                                                | Overview of LTE Technology................................................................................8                    | Overview of LTE Technology................................................................................8                    |                                                                                |
|                                                                                | 2.1                                                                                | Evolution of 3GPP Standards                                                                                | .........................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does The NIST Definition of Cloud Computing provide? (Part 5)

[Assistant]
and network bandwidth. - Rapid  elasticity. Capabilities can  be  elastically  provisioned  and  released,  in  some  cases automatically, to scale rapidly outward and inward commensurate with demand.
To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time. - Measured service. Cloud systems automatically control and optimize resource use by leveraging a metering capability 1 at some level of abstraction appropriate to the type of service (e.g., storage,  processing,  bandwidth,  and  active  user  accounts). Resource  usage  can  be monitored,  controlled,  and  reported,  providing  transparency  for  both  the  provider  and consumer of the utilized service. ## Service Models:

Software as a Service (SaaS). The capability provided to the consumer is to use the provider's applications  running  on  a  cloud  infrastructure 2 . The  applications  are  accessible  from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even  individual  application  capabilities,  with  the  possible  exception  of  limited  userspecific application configuration settings. Platform as a Service (PaaS) . The capability provided to the consumer is to deploy onto the cloud infrastructure  consumer-created  or  acquired  applications  created  using  programming

1 Typically this is done on a pay-per-use or charge-per-use basis. 2 A  cloud  infrastructure  is  the  collection  of  hardware  and  software  that  enables  the  five  essential  characteristics  of  cloud computing. The cloud infrastructure can be viewed as containing both a physical layer and an abstraction layer.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters:

3.2.2. 3.2.2), or a twisted Edwards curve (Section 3. 3.2.2.

Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Index of Automated System Design Requirements as Derived from the OMB Privacy Act Implementation Guidelines provide? (Part 2)

[Assistant]
cessing Standards Task Group 15. This task group was established by the Department of Commerce within its National Bureau of Standards to develop standards and guidelines in Computer Systems Security.
Special recognition should go to the following participants of the task group which has comnended their efforts in preparing this document: Margaret W. Alter, Office of Federal Management Policy, General Services Administration; Philip H. Diamond, Department of Data Management, Veterans Administration; and Robert H. Follett, Office of Federal Business Relations, International Business Machines Corporation. Any comments you have concerning this index or its use are welcomed. Please forward them to the Associate Director for ADP Standards, Institute for Computer Sciences and Technology, National Bureau of Standards, Washington, D.C. 20234, or telephone (301) 921-3157. * Privacy Act of 1974; Public Law 93-579. ** Privacy Act Implementation Guidelines and Responsibilities, Office of Management and Budget, dated July 1, 1975 and published in the Federal Register on July 9, 1975 (40 FR 28947-28978). CO Ui 3 H u < u < > U OS I-t cu Q S O 00 s: -CO CTl C/) Q r-t < -J O ^ 3 UJ < E H O S O X a; Q 2 O 1-1 Ui > u Q cu

c

4J

£

43

^1

•H

3

CT

43

ca

u

•H

c

u

X

43

•H

|                            | m .

Index of Automated System Design Requirements as Derived from the OMB Privacy Act Implementation Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies:

s for an other than authorized purposes, have access or potential                              |

|                                   | access to sensitive information, whether physical or electronic.
|
|-----------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Categorization                    | The process of determining the security category for information or an information system. Security categorization methodologies are described in CNSS Instruction 1253 for national security systems and in FIPS Publication 199 for other than national security systems. |
| Ciphertext                        | Data in its encrypted form. |
| Confidentiality                   | The property that sensitive information is not disclosed to unauthorized entities. |
| Critical Infrastructure           | The essential services that support a society and serve as the backbone for the society's economy, security and health. |
| Cryptographic algorithm           | A well-defined computational procedure that takes variable inputs, including a cryptographic key (if applicable), and produces an output. |
| Cryptographic Key                 | A parameter used in conjunction with a cryptographic algorithm that determines its operation in such a way that an entity with knowledge of the key can reproduce or reverse the operation, while an entity without knowledge of the key cannot. |
| Cryptography                      | The science of information hiding and verification. It includes the protocols, algorithms and methodologies to securely and consistently prevent unauthorized access to sensitive information and enable verifiability of the information.

Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Practical Combinatorial Testing provide? (Part 5)

[Assistant] | 12 | | 3.1 | 3.1 | Simple Application Platform Example..............................................................12 | | | 3.2 | 3.2 | Smart Phone Application Example....................................................................14 | | | 3.3 | 3.3 | Cost and Practical Considerations | .....................................................................16 | | 3.4 | 3.4 | Chapter Summary | ..............................................................................................17 | | 4 | 4 | INPUT PARAMETER TESTING ................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to User's Guide to Telework and Bring Your Own Device (BYOD) Security:

checking email from a kiosk computer at a hotel or from a friend's mobile phone. However, teleworkers typically do not know if such devices have been secured properly or if they have been compromised.
Consequently, a teleworker could use a device infected with malware that steals their information (e.g., passwords, email messages, and other sensitive data). Many organizations either prohibit unknown devices from being used for remote access or permit use only by having the teleworker first restart the PC with special removable media inserted so that the PC will reboot into a secure environment for telework purposes.

User's Guide to Telework and Bring Your Own Device (BYOD) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

Cryptographic techniques are potentially very useful to improve  the  security  and  privacy  properties  of  IMDs  through stronger authentication protocols and (confidentiality and integrity)  protected  communications  over  wireless  channels.  However,  since  IMDs  operate  in  very  constrained  environments (such  as  device  size,  cost,  and  power  availability,)  traditional cryptographic techniques and protocols may be inappropriate. More compatible cryptographic suites and protocols need to be devised for use on IMDs and applied in a very selective manner to optimize the security protection from these power intensive operations.  The  body  of  research  conducted  for  cryptography for  sensor  networks  are  directly  applicable  [8]  to  applying cryptographic techniques to IMDs.

## A. Equipment Control and Recipe Integrity

## B. Process Data Integrity

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile:

| RS.IM | Improvements | | RC | Recover | RC.RP | Recovery Planning | | RC | Recover | RC.IM | Improvements | | RC | Recover | RC.CO | Communications |

Cybersecurity Framework Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Minimum Security Requirements for Multi-User Operating Systems:

or activity. (R)
3. The system shall protect the security audit trail from unauthorized access. (R)
- a. Maintenance and management of the security audit trail files shall require privilege. (R)
- b.
The system should support an option to maintain the security audit trail data in encrypted format.' (A)

Minimum Security Requirements for Multi-User Operating Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The NIST Risk Management Framework (RMF), described in NIST Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, is a methodology for implementing risk management at the information systems tier. The RMF (depicted in Figure 2) identifies six distinct steps that provide a disciplined and structured process to integrate information security risk management activities into the system development life cycle. The RMF addresses security concerns of organizations related to the design, development, implementation, operation, and disposal of information systems and the environments in which those systems operate. The criteria for whether a security control is assurance- or functionality-related is based on the overall characteristics of the control. In general, assurance-related controls are controls that: (i) define processes, procedures, techniques, or methodologies for designing and developing information systems and system components; (ii) provide supporting operational processes including improving the quality of systems, components, or processes; (iii) produce security evidence from developmental or operational activities; (iv) determine security control effectiveness or risk; or (v) improve personnel skills, expertise, and understanding. Many organizations use well-known international information security standards as the basis or as a supplemental source of security controls for risk management. To aid in selection and comparison, SP 800-53 Rev. 4 provides mapping tables to provide organizations with a general indication of security control coverage with respect to ISO/IEC 27001, Information technologySecurity techniques-Information security management systems-Requirements and ISO/IEC 15408, Information technology -- Security techniques -- Evaluation criteria for IT security .

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.5 (NIST 3.1.5)?

[Assistant]
According to Guidelines for Managing the Security of Mobile Devices in the Enterprise:

3.1.5. 3.1.5.

Guidelines for Managing the Security of Mobile Devices in the Enterprise


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary Report for the Virtual Workshop Addressing Public Comment on NIST Cybersecurity for IoT Guidance provide? (Part 5)

[Assistant]
| 1.3 About the Workshop Addressing Public Comment on NIST Cybersecurity for IoT Guidance...................................................................................................
2 |
| 2 Event Summary and Key Takeaways ...................................................................4                          | 2 Event Summary and Key Takeaways ...................................................................4                                                                                |
|                                                                                | 2.1 Plenary Sessions ............................................................................................

Summary Report for the Virtual Workshop Addressing Public Comment on NIST Cybersecurity for IoT Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

In  working  with  the  Office  of  Management  and  Budget  to  develop  standards  and  guidelines
required by FISMA, NIST consults with federal agencies, state, local, and tribal governments, and
private sector organizations to improve information security and privacy, avoid unnecessary and
costly duplication of effort, and help ensure that its publications are complementary with the
standards and guidelines used for the protection of national security systems. In addition to a
comprehensive  and  transparent  public  review  and  comment  process,  NIST  is  engaged  in  a
collaborative partnership with the Office of Management and Budget, Office of the Director of
National Intelligence, Department of Defense, Committee on National Security Systems, Federal
CIO Council, and Federal Privacy Council to establish a Risk Management Framework (RMF) for
information security and privacy for the Federal Government. This common foundation provides
the Federal Government and their contractors with cost-effective, flexible, and consistent ways
to manage security and privacy risks to organizational operations and assets, individuals, other
organizations, and the Nation. The framework provides a basis for the reciprocal acceptance of
security  and  privacy  control  assessment  evidence  and  authorization  decisions  and  facilitates
information sharing and collaboration. NIST continues to work with public and private sector
entities  to  establish  mappings  and  relationships  between  the  standards  and  guidelines
developed by NIST and those developed by other organizations. NIST anticipates using these
mappings and the gaps they identify to improve the control catalog. CHAPTER ONE   INTRODUCTION ...................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY ...................................................................................................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security Guidelines for Storage Infrastructure provide? (Part 5)

[Assistant]
ay; file storage service; block storage service; object storage service; storage virtualization; software-defined storage; hyper-converged storage; data protection; cloud storage; backup; replication.
## Acknowledgements

The authors like to express their sincere thanks to NetApp, Dell EMC, Storage Networking Industry Association (SNIA), IEEE, Infinidat, and the Center for Cybersecurity Standards at NSA for their extensive, insightful feedback. Our special thanks to Yaniv Valik of Continuity Software for his valuable input during the writing of this document. ## Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Executive Summary

Storage, computing, and networking form the three fundamental building blocks of an information technology infrastructure. Just like computing and network technologies, storage technology has also evolved over the years. Higher capacity storage media and storage system architecture are the two fronts on which storage technology has evolved. The developments on the second front have enabled storage services to support many new and evolving computing use cases but have also introduced storage management complexity and many security challenges.

Security Guidelines for Storage Infrastructure


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Foundations of a Security Policy for Use of the National Research and Educational Network:

| 1 Introduction | 1 Introduction | 1 Introduction | 1 | |------------------------------------------------|----------------------------------------------------------|----------------------------------------------------------|-----| | 1.1 | | Background | 1 | | | 1.2 | Purpose and Scope of Report | 1 | | | 1.3 | Overview of Report | 2 | | 2 | Evolution of the NREN | Evolution of the NREN | 3 | | 2.1 | Introduction | Introduction | 3 | | 2.2 | Early DARPA Sponsorship | Early DARPA Sponsorship | 4 | | | 2.2.1 | National Science Foundation Sponsorship | 5 | | | 2.2.2 | Supercomputing Initiative | 5 | | | 2.2.3 | Development of a Higher Capacity Backbone | 5 | | | 2.2.4 | Experimental Gigabit Networks | 6 | | 2.3 | The Internet | The Internet | 7 | | 2.4 | Present Federal Interest and Initiatives | Present Federal Interest and Initiatives | 8 | | | 2.4.1 | Federal Councils, Committees and Information Offices | 8 | | | 2.4.2 | High Performance Computing and Communications Initiative | 9 | | | 2.4.3 | Mandate for a National Research and Educational Network | 9 | | | 2.4.4 | Pending Questions on General

Foundations of a Security Policy for Use of the National Research and Educational Network


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice PS.L2-3.9.3 (NIST 3.9.3)?

[Assistant]
According to De-Identifying Government Datasets_ Techniques and Governance:

3.9.3. 3.9.3.

De-Identifying Government Datasets_ Techniques and Governance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to An Introduction to Information Security:

3.2.4 Penetration Testing

Penetration testing can use many methods to attempt a system break-in.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommended Criteria for Cybersecurity Labeling of Consumer Software provide? (Part 2)

[Assistant]
bersecurity programs, projects and publications, visit the Computer Security Resource Center. Information on other efforts at NIST and in the Information Technology Laboratory (ITL) is also available.
Submit comments on this publication to:

labeling-eo@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

All comments are subject to release under the Freedom of Information Act (FOIA). ## Acknowledgments

The  authors  of  this  document  wish  to  thank  all  of  those  who  provided  input  on  this  effortespecially those who attended our workshops, participated in one-on-one phone calls, and provided written comments on our draft. ## Audience

This document is intended for three primary audiences:

1. Organizations which may be interested in implementing a labeling scheme for consumer software. 2. Organizations  which  produce  or  distribute  consumer  software  and  are  interested  in participating in future labeling programs. 3. Consumers who are interested in understanding a potential future labeling program. ## Document Conventions

The terms 'should' and 'should not' indicate that among several possibilities one is recommended as particularly suitable, without mentioning or excluding others, or that a certain course of action is  preferred  but  not  necessarily  required,  or  that  (in  the  negative  form)  a  certain  possibility  or course of action is discouraged but not prohibited.

Recommended Criteria for Cybersecurity Labeling of Consumer Software


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Recommendation for Block Cipher Modes of Operation_ Galois_Counter Mode (GCM) and GMAC:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and  Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement  and  standards  infrastructure.  ITL  develops  tests,  test  methods,  reference  data,  proof  of concept  implementations,  and  technical  analyses  to  advance  the  development  and  productive  use  of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive  unclassified  information  in  Federal  computer  systems.  This  Special  Publication  800-series reports  on  ITL's  research,  guidance,  and  outreach  efforts  in  computer  security,  and  its  collaborative activities with industry, government, and academic organizations.

Recommendation for Block Cipher Modes of Operation_ Galois_Counter Mode (GCM) and GMAC


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems:

This report provides practical cybersecurity guidance for small-scale solar inverter implementations that are typically used in homes and small businesses. These guidelines are informed by a review of known smart-inverter vulnerabilities documented in the National Vulnerability Database (NVD), a review of information about known smart-inverter cyberattacks, and testing of five example smart inverters. The report also provides recommendations to smart-inverter manufacturers on the cybersecurity capabilities needed in their products to implement the seven guidelines. These recommendations build on the Internet of Things (IoT) cybersecurity capability baselines defined in NIST IR 8259A and IR 8259B by providing smartinverter-specific information for some of the baseline cybersecurity capabilities. | E.1.6. ISA/IEC 62443-2-1.......................................................................................................................33                                                                                |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Appendix F. Smart Inverter Vulnerability Survey...............................................................................37                                                                                |
| List of Tables                                                                                |
| Table 1.

Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guidelines for the Secure Deployment of IPv6:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. The authors would like to acknowledge Tim Grance of NIST for his keen and insightful assistance and encouragement throughout the development of the document. The authors particularly want to thank Mark Carson, Doug Montgomery and Stephen Nightingale of NIST and Scott Hogg for their careful review and valuable contributions to improving the quality of this publication. |     | 5.3.3                                                                                | Support for Multicast ..................................................................................

Guidelines for the Secure Deployment of IPv6


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guidelines for Managing the Security of Mobile Devices in the Enterprise:

....................................................................18                   |                                                                                |
| 4.2.2.
| Mobile Application Management............................................................................20                    |                                                                                |
| 4.2.3. | Mobile Threat Defense...........................................................................................21             |                                                                                |
| 4.2.4. | Mobile App Vetting.................................................................................................22          |                                                                                |
| 4.2.5. | Virtual Mobile Infrastructure ...................................................................................22            |                                                                                |
| 4.2.6. | Application Wrapping.............................................................................................23            |                                                                                |
| 4.2.7. | Secure Containers.................................................................................................23           |                                                                                |
|                                                                                | Recommended Mitigations and Countermeasures                                                                                | ....................................................23                                             |
| 4.3.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.3 (NIST 3.1.3)?

[Assistant]
According to Recommendation for Stateful Hash-Based Signature Schemes:

3.1.3 of [1]) shall be generated using the pseudorandom key generation method specified in Algorithm 10' in Section 7.

Recommendation for Stateful Hash-Based Signature Schemes


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Ransomware Risk Management_ A Cybersecurity Framework Profile:

| Category | Subcategory and Selected Informative References | Ransomware Application | |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Identify | | | | Asset Management (ID.AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy.

Ransomware Risk Management_ A Cybersecurity Framework Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Notional Supply Chain Risk Management Practices for Federal Information Systems:

nsequences throughout the supply chain and element life cycle. - g) Establish mechanisms and processes for checking and auditing unique identifications within the acquirer and integrator environments.
- h) Document that integrator personnel are assigned appropriate roles throughout the system/element life cycle, regardless of personnel turnover, to ensure that the visibility of critical processes and elements is maintained.

Notional Supply Chain Risk Management Practices for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i:

NIST recommends that Federal agencies implement the following recommendations to assist in establishing and maintaining robust security for their IEEE 802.11i-based WLANs. Personnel responsible for their implementation and maintenance should read the corresponding sections of the document to ensure they have an adequate understanding of important related issues.

Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i